gpg --auto-key-retrieve SHA512SUMS.sign
The key is retrieved from user's default keyring or keyservers. The usual keyserver pool (pool.sks-keyservers.net) has the Debian CD signing key. How we can trust that the key is the right one is another matter. It is signed by many Debian developers. (setq search-default-mode #'char-fold-to-regexp)